Highlights from the Commissioner’s 2024-2025 annual report
June 5, 2025
Privacy Act Bulletins are intended to offer lessons learned, best practices and other important privacy news, trends and information related to privacy protection in the federal public sector. We encourage you to share this information with colleagues.
The Privacy Commissioner of Canada’s annual report to Parliament for 2024-2025 was tabled today.
The report, entitled Prioritizing privacy in a data-driven world, highlights the Office of the Privacy Commissioner of Canada’s key activities of the year, including work with federal institutions to promote and protect individuals’ fundamental right to privacy.
“At a time when the personal information of Canadians is being collected, used, and shared at an unparalleled pace and volume on a global scale, effective privacy protection requires more than the status quo,” Commissioner Philippe Dufresne writes in his annual report message.
“Prioritizing privacy as a fundamental right reflects our Canadian values and ambitions and reinforces the freedoms and trust that underpin our democracy.”
Here are some highlights from the report:
OPC Transformation
In January 2025, following an in-depth review of its operational model, Commissioner Dufresne unveiled an internal transformation plan for a modernized OPC that delivers on its mandate and strategic priorities in the most efficient and impactful way possible.
The transformation will aim to allow the OPC to respond more rapidly and effectively to emerging issues, with greater focus on early interventions and proactive engagement with institutions. The plan re-frames the OPC’s compliance function as a continuum, by combining proactive engagement and formal investigative functions into one sector.
The transformation will also enable the OPC to continue to focus on advancing efforts across its key priority areas, including children’s privacy and addressing the privacy implications of emerging technologies like AI to support innovation while protecting Canadians’ fundamental right to privacy.
Top trends in privacy
The impact of generative AI, data breaches, and children’s privacy are key trends that have dominated the domestic and international privacy landscape and have driven much of the OPC’s work in the last fiscal year.
According to the OPC’s latest survey of Canadians (2024-2025), 83% of Canadians have some level of concern about their privacy when using AI tools, and 88% are at least somewhat concerned about their personal information being used to train AI systems.
A number of federal institutions exploring the use of AI to streamline and automate processes involving personal information consulted with the OPC for guidance and advice on assessing privacy risks and integrating the appropriate privacy protections.
Government advisory work
In 2024-2025, the OPC focused its government advisory efforts on working more closely with federal law enforcement and intelligence communities, consulting and providing advice on initiatives that could impact the privacy of Canadians.
The OPC organized 18 government advisory events, including information sessions with the Treasury Board Secretariat of Canada related to privacy in the workplace and privacy in government contracting, as well as a special event with Chief Privacy Officers and Chief Information Officers on the importance of collaboration between these communities.
Privacy Act breaches
With a threat environment that is constantly evolving, data breaches continue to be a significant issue of concern. As stewards of Canadians’ sensitive personal information, several government departments and agencies are attractive targets for malicious actors.
In 2024-2025, the OPC received 615 breach reports from federal government institutions, up from 561 the previous year, while the number of people affected more than doubled, to 309,865 individuals, from 138,434.
Mishandling of information (e.g., data entry error, misdirected correspondence, labelling error) was the cause of 508 breaches reported under the Privacy Act, followed by cyber incidents (55), employee snooping (37), and security vulnerabilities (14).
Privacy Act investigations
In the 2024-2025 fiscal year, the OPC accepted 1,279 complaints under the Privacy Act, a 15% increase over the previous year. More than half of complaints related to the length of time that institutions took to respond to requests for access to personal information.
The report includes summaries of investigations that were completed in the 2024-2025 fiscal year.
Further reading
Sign up for future Privacy Act Bulletins by subscribing to our RSS feed.
- Date modified: